Systems and methods for enhancing electronic discovery searches
A computer-implemented method for enhancing electronic discovery searches may include (1) receiving a search query for at least one instance of a user being identified within a backup image of a volume of data, the search query being conducted for electronic discovery, (2) identifying metadata associated with the backup image specifying at least one action performed by the user on a computing system while the volume of data was mounted for use on the computing system, (3) performing the search query on the backup image and receiving a result of the search query in response to performing the search query, (4) enhancing the result of the search query with contextual information relating to the search query based on the metadata, the contextual information facilitating further electronic discovery, and (5) providing the enhanced result of the search query. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for enhancing electronic discovery searches, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
monitoring a volume of data for an attempt, by a user, to access a file on the volume of data, wherein the attempt to access the file includes at least one of a write attempt directed to the file and a read attempt directed to the file;
recording contextual information describing an action performed by the user distinct from the attempt to access the file, wherein the recording comprises recording at least one additional attempt by the user to access an additional file on the volume of data and associating the attempt to access the file with the additional attempt to access the additional file, wherein the associating comprises specifying an order in which the attempt and the additional attempt occurred;
receiving a request to back up the volume of data after recording the contextual information in association with the attempt to access the file; and
in response to identifying the request, associating the recorded contextual information with a backup of the volume of data created in response to the request, the recorded contextual information facilitating electronic discovery performed on the backup of the volume of data.
2. The computer-implemented method of claim 1 , wherein recording the contextual information comprises recording an identifier of a user account that attempted to access the file.
3. The computer-implemented method of claim 1 , wherein recording the contextual information comprises: identifying the user that performed the attempt to access the file.
4. The computer-implemented method of claim 1 , wherein recording the contextual information comprises specifying a context that facilitated the attempt to access the file and that is not reflected in the backup or in the volume of data.
5. The computer-implemented method of claim 1 , wherein recording the contextual information comprises: identifying the user that performed the attempt to access the file; identifying a search query performed by the user on at least a portion of the volume of data before the attempt; recording an association between the search query and the attempt.
6. The computer-implemented method of claim 1 , wherein associating the recorded contextual information with the backup comprises associating contextual information describing the recorded at least one additional attempt to access the additional file with the backup, wherein the contextual information facilitates electronic discovery relating to the user by specifying a context in which the user made the attempt to access the file.
7. The computer-implemented method of claim 6 , wherein: the user made the attempt to access the file on the volume of data via a computing system; specifying the context in which the user made the attempt to access the file comprises specifying the context in which the user made the attempt to access the file on the volume of data while the volume of data was mounted for use on the computing system.
8. A system for enhancing electronic discovery searches, the system comprising: an enhancing module, stored in memory, that:
monitors a volume of data for an attempt, by a user, to access a file on the volume of data, wherein the attempt to access the file includes at least one of a write attempt directed to the file and a read attempt directed to the file;
records contextual information describing an action performed by the user distinct from the attempt to access the file, wherein the recording comprises recording at least one additional attempt by the user to access an additional file on the volume of data and associating the attempt to access the file with the additional attempt to access the additional file, wherein the associating comprises specifying an order in which the attempt and the additional attempt occurred;
receives a request to back up the volume of data after recording the contextual information in association with the attempt to access the file; and
in response to identifying the request, associates the recorded contextual information with a backup of the volume of data created in response to the request, the recorded contextual information facilitating electronic discovery performed on the backup of the volume of data; and
at least one physical processor configured to execute the enhancing module.
9. The system of claim 8 , wherein the enhancing module records the contextual information by recording an identifier of a user account that attempted to access the file.
10. The system of claim 8 , wherein the enhancing module records the contextual information by: identifying the user that performed the attempt to access the file.
11. The system of claim 8 , wherein the enhancing module records the contextual information by recording contextual information specifying a context that facilitated the attempt to access the file and that is not reflected in the backup or in the volume of data.
12. The system of claim 8 , wherein the enhancing module records the contextual information by: identifying the user that performed the attempt to access the file; identifying a search query performed by the user on at least a portion of the volume of data before the attempt; recording an association between the search query and the attempt.
13. The system of claim 8 , wherein the enhancing module associates the recorded contextual information with the backup by associating contextual information describing the recorded at least one additional attempt to access the additional file with the backup, wherein the contextual information facilitates electronic discovery relating to the user by specifying a context in which the user made the attempt to access the file.
14. The system of claim 13 , wherein: the user made the attempt to access the file on the volume of data via a computing system; the enhancing module specifies the context in which the user made the attempt to access the file comprises by the context in which the user made the attempt to access the file on the volume of data while the volume of data was mounted for use on the computing system.
15. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
monitor a volume of data for an attempt, by a user, to access a file on the volume of data, wherein the attempt to access the file includes at least one of a write attempt directed to the file and a read attempt directed to the file;
record contextual information describing an action performed by the user distinct from the attempt to access the file, wherein the recording comprises recording at least one additional attempt by the user to access an additional file on the volume of data and associating the attempt to access the file with the additional attempt to access the additional file, wherein the associating comprises specifying an order in which the attempt and the additional attempt occurred;
receive a request to back up the volume of data after recording contextual information in association with the attempt to access the file; and
in response to identifying the request, associate the recorded contextual information with a backup of the volume of data created in response to the request, the recorded contextual information facilitating electronic discovery performed on the backup of the volume of data.
16. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions cause the computing device to record the contextual information by recording an identifier of a user account that attempted to access the file.
17. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions cause the computing device to: identify the user that performed the attempt to access the file.